fix(drone-airspace): refuse cross-site requests to the FAA proxy

A foreign Origin or Sec-Fetch-Site: cross-site request was answered and
counted against the client's 60-a-minute quota, and could start a refresh.
Run the keyless same-site checks the other map routes use before rate
limiting and cache acquisition; reverse-proxy forwarding headers stay
accepted. List the route with the keyless map routes in SECURITY.md.

docs/CURRENT-STATE.md

@@ -4103,7 +4103,10 @@ FeatureServer, caps the body, and reuses a one-hour snapshot, serving the last
 good payload as stale for at most 24 hours when a refresh fails; the layer row
 then reads STALE, dated by that snapshot's fetch. An answer with no valid zone, or
 paging that ends while the service still flags more records, counts as a
-failed refresh. Client-supplied URLs are rejected.
+failed refresh. Client-supplied URLs are ignored. The route uses the keyless
+same-site checks: a cross-site browser request gets `403` before it spends the
+per-client quota or starts a refresh, and the app still works behind a reverse
+proxy.
 Polygons keep holes; pick ownership is deliberately unregistered so sibling
 cards still work over a zone. The row legend and selected card state that the
 layer is informational only and not a substitute for B4UFLY / LAANC.